Requirements pursuant to Article 12 of EU REGULATION 679/2016 – Information, communications and transparent methods for the exercise of the rights of the interested party – Information pursuant to the Articles 13-14 of EU REGULATION 679/2016
According to EU Regulation 679/2016 containing “General Data Protection Regulation” (“EU / 679 / 2016 ”), My Frame Srl (hereinafter “the Company”), as Data Controller, is required to provide information regarding the use of personal data of its customers.
This information also refers to the processing performed by the subjects who perform, on behalf of the Company, the technical and organizational tasks described in paragraph 1.
1. Purposes and methods of processing. Nature of providing data.
The personal data held by the Company are provided directly by the subject to whom the personal data refer (“Interested”). Personal data may also be acquired by the Company in the exercise of its business or by third parties.
Personal data is processed within the normal activity of the Company for the following purposes:
a) purposes strictly connected and instrumental to the management of relations with the interested party.
Providing the personal data necessary for these purposes is not mandatory , but the refusal to supply them may involve – in relation to the relationship between the data and the requested service – the Company’s inability to provide the service itself. Their processing does not require the consent of the data subject;
b) fulfillment of obligations imposed by laws, regulations or Community legislation.
Providing personal data necessary for these purposes is mandatory and processing does not require the consent of the interested party;
c) other functional purposes of the Company, such as:
– the detection of the degree of customer satisfaction on the quality of the services rendered and on the activity carried out by the Company, performed, also through specialized companies, through personal or telephone interviews, questionnaires, etc .;
– the promotion and sale of products and services of the Company, carried out through letters, telephone, advertising material, automated communication systems, e-mail marketing, etc.
– the development of studies and market research, carried out through personal or telephone interviews, questionnaires, sending of informative material on products and services provided by the Company.
Providing the data necessary for the purposes referred to in the previous letter. c) is not mandatory and their processing requires the consent of the interested party.
In relation to the purposes described, the processing of personal data takes place by manual processing or by electronic or automated means, according to logics strictly related to the same purposes and in any case in order to guarantee the confidentiality and security of personal data.
For certain services, the Company avails itself of trust companies which, as Data Processors, perform technical or organizational tasks, such as:
the provision of IT services related to the supply, development and maintenance of software and hardware systems necessary or in any case functional to the performance of the services provided by the company, the detection of the degree of satisfaction or customer needs; the activity of accounting processing; the activity of sending email marketing.
2. Categories of data subject to processing.
In relation to the purposes described in the preceding paragraph 1, the Company and the other subjects who carry out, on behalf of or in favor of the same, the tasks described in paragraph 1 above, process the personal data relating to: Name and Surname, address and other elements of personal identification (date of birth, place of birth, tax code of the legal representative); fiscal Code; e-mail; phone; identification details of banking relationships (eg IBAN); the data relating to the family and personal situations, the data relating to the degree of education and the work of the interested party as well as, for the companies, the personal data of the legal representative / attorney.
In the provision of the services and activities indicated in this statement, the Company does not need to process personal data that art. 9 of the aforementioned Regulation defines as “particulars” (such as, for example, the personal data suitable to reveal the state of health, political and union opinions, religious beliefs, etc.).
3. Categories of subjects to whom the data may be communicated or who can learn about them as data processors or processors.
To pursue the purposes described in paragraph 1, the Company needs to communicate the personal data of the Interested Parties to third parties, belonging to the following categories:
– persons who carry out, on behalf of the Company, the technical or organizational tasks indicated in paragraph 1, including the accounting processing company;
– Authorities and Supervisory Bodies, Judicial Authorities and in general, subjects, public or private, with functions of public importance;
– external companies and / or professionals used by the Company in the context of assistance and consultancy relationships;
– third-party companies for processing aimed at promotional initiatives, where the interested party has expressed its consent.
The recipients of the communications described in this information act in total autonomy, as distinct data controllers, or, in some cases, have been designated by the Company as data processors. Their list, constantly updated, is available from the Company.
Some categories of people, as data processors, can access customers’ personal data for the purpose of fulfilling the tasks assigned to them. In particular, the Company has appointed, as persons in charge of processing customer data, the Company’s employees, including system administrators, for the purpose of fulfilling the duties assigned to them, the temporary workers used by the Company, the interns.
In addition, the individuals designated by the Company as Data Processors may become aware of the personal data when performing the tasks assigned to them. The identity of the data processors designated by the Company may be known in the manner indicated in paragraph 5 below.
The personal data processed by the Company and by the persons who carry out the technical and organizational tasks described on paragraph 1 on behalf of the same are not subject to disclosure.
4. Terms of retention of personal data.
Personal data will be processed for the entire duration of the established contractual relationships, and also subsequently, for the fulfillment of all legal obligations and in any case for a period not exceeding 10 years from the termination of the contractual relationship or beyond in the cases expressly requested by the law. In the case of treatments for promotional purposes, up to the request of the interested party of any opposition to the sending and the will of these to renounce the receipt of commercial communications.
5. Rights of the interested party pursuant to Articles 15 and ss. of EU Regulation 679/2016.
We inform you that the legislation on the protection of personal data gives interested parties the opportunity to exercise specific rights. In particular, each interested party has:
a) the right of access, expressly provided for by the art. 15 of Regulation 679/2016, ie the possibility of accessing all personal information concerning him;
b) the right of rectification, expressly provided for by the art. 16 of Regulation 679/2016, ie the possibility of obtaining the update of inaccurate personal data concerning him without justified delay;
c) the right to be forgotten, expressly provided for by the art. 17 of Regulation 679/2016, consisting of the right to cancel personal data concerning the person concerned;
d) the right to limit processing when one of the hypotheses envisaged by art. 18 of Regulation 679/2016;
e) the right to data portability, expressly provided for by the art. 20 of Regulation 679/2016, ie the right to obtain their data in an interoperable format and / or the right to have their personal data transmitted to another data controller without hindrance by this Company;
f) the right to revoke consent at any time, expressly provided for by art. 7 of Regulation 679/2016;
g) the right to lodge a complaint with the Guarantor in the event of a breach in the processing of data pursuant to art. 77 of Regulation 679/2016;
h) the right to appeal to the courts in the event of unlawful processing of the data, even against the acts undertaken by the Guarantor pursuant to Article 78 of Regulation 679/2016;
i) the right to object at any time to processing by sending commercial communications and advertising or direct sales material, by sending an e-mail to the address email@example.com, expressly requesting the deletion of one’s names from the advertising list.
6. Data Controller and Data Processors.
The data controller is My Frame S.r.l., with its registered office at Foro Buonaparte 59 – 20121 Milan (MI) – Tel. +39 0287178267 – E-mail: firstname.lastname@example.org
The requests relating to the exercise of the rights envisaged by the applicable legal provisions can be forwarded in writing or by e-mail sent to the box, to the data controller in the person of the legal pro-tempore Representative domiciled for the office at the registered office of the My Frame Srl.
With the same method, the complete list of Managers appointed by My Frame S.r.l.